Privacy

Last updated 2026-09-14. This page describes the site as it is built. If a sentence here stops matching the code, the sentence is the bug — say so and it gets fixed.

Nothing you type is transmitted

The calculator, the collapse list, the split planner and the containment check are arithmetic on integers. They run in the page you already downloaded: there is no upload endpoint, no backend, no account system and no database behind this site.

The engine ships with the page. Open assets/cidr.js — a plain file at the same origin as this page, no build step and no login — and search for fetch, XMLHttpRequest or sendBeacon; none of those identifiers appear anywhere in it. That is a check you can actually run, not a promise.

Copy link writes the current tab and what you typed into the fragment of the address — the part after the #. Browsers do not transmit a fragment: it is not in the HTTP request, it is not in any Referer header, and this site has no server that could record it. There is no account, no saved link and no recent list, so nothing is kept on our side either.

What does leave is whatever you do with the address afterwards. Paste that link into a chat, a ticket or an email and its contents travel with it — the fragment is readable by anyone who can read the message. If that matters, share the CIDR notation instead: it says the same thing and is safe to repeat.

No registry lookups, on purpose

A subnet calculator can be made to look clever by asking IANA who owns a block. This one does not: it reports the categories from RFC 6890 as compiled into the code, and it will tell you when a range is unallocated-looking rather than pretend to know. Asking a registry would mean your network plan left your browser, and a network plan is exactly the sort of thing worth keeping local.

The same reasoning is why there is no whois button here.

Who does see something

These files are delivered by GitHub Pages from an IP in 185.199.108.0/22. Like every web server, GitHub's edge records the standard request line: your IP address, user agent string, the path requested, a timestamp and the Referer header if your browser sent one. That log exists whether or not you type anything, because requesting the page is what makes the page appear.

If you reached this page from a search engine, the search engine also knows you asked. That is on their side, not ours.

This site is served with Google AdSense enabled. Adverts come from pagead2.googlesyndication.com and googleadservices.com, so your browser talks to Google when you load a page here — that is a third-party request, and it is visible in a network panel. We reworded every sentence that would stop being true, rather than keep it.

Google uses cookies to serve ads based on your prior visits to this or other sites. You can opt out at https://www.google.com/settings/ads or at https://www.aboutads.info/choices; how Google uses data it collects through its ad platform is described at https://policies.google.com/technologies/partner-sites.

In the EEA, the UK and Switzerland you should see a consent message before any personalised advertising. The amount of data shared with Google follows that consent choice, not anything on this site.

Advertising revenue does not change what the calculator does: the arithmetic path is identical with an advert on the page or without one.

Analytics, cookies and storage

This build ships no analytics of any kind; if one is ever added, the request shows up in your own network panel and this paragraph gets rewritten. Nothing measures which prefixes you typed or how long you stayed — a counter would need a request to whoever serves it, and this site makes none for that purpose.

The site sets no cookies of its own and keeps nothing in localStorage or IndexedDB. Reload the page and your input is gone. With advertising enabled Google may set cookies on its own domains; those are theirs to read, not ours.

How the numbers are checked

Every field the calculator reports is compared against Python's standard-library ipaddress module, on 356 generated prefixes covering both address families and the boundary cases, and on 15 malformed inputs that both implementations must reject. The vectors and the comparison run in the browser, on this origin: /test/ shows the result of each assertion. That page is not indexed and is not a promise — it is the test, executing.

Where the two disagree, the bug is in this site and gets fixed here rather than explained away.

Feedback

A wrong number, or a sentence on this page that no longer matches reality: the quiet link that appears next to a failure message, and the Feedback link in the footer, open a new issue on https://github.com/george-poe/cidrkit-com with a short note already typed in it: the page path, which tab the failure happened on, the date of the build you were looking at, and then whatever that failure had to give — the length in bytes of what you typed together with the error message exactly as this page printed it, or a one-line note naming the limit you hit. It is an ordinary link, so there is no separate submission channel for feedback: what appears in the form is what the link put there, on screen before anything is sent, and you can read it, change it, or delete it. The 404 page prefills a title and nothing else, because there is no run to report there.

One limit stated plainly rather than glossed: an error message can quote a short fragment of what you typed, because that is what makes an error message useful — the parse errors here name the octet or the IPv6 group that did not parse, repeated as you wrote it. Those fields are length-capped at 120 characters for that reason, what you typed is never attached whole, and when the note still runs long it is trimmed rather than sent in full. If a fragment in the pre-filled note is sensitive, cut it before sending — once sent, the issue is public and GitHub keeps it under its own terms, not ours.

The repository is where these pages and their tests are built, so a report lands next to the code that would have to change. Nobody but the person who builds this site reads it. There is no email list.

The footer of every page also lists a mailbox, feedback@cidrkit.com. It is a different channel with different properties: nothing is generated into it. There is no page path, no byte count, no error text in the envelope — whatever arrives is only what you typed, which is why a useful mail usually quotes the error itself. Mail to that address is relayed by Cloudflare Email Routing to an outside mailbox; the pages still send nothing, and no request this site makes carries your document.